1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Trojan.Heur.aqX@a8dzk7h on my laptop

Discussion in 'Malware and Virus Removal Archive' started by jpab29, 2012/07/26.

  1. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    [Resolved] Trojan.Heur.aqX@a8dzk7h on my laptop

    Hello everyone! I just spent the whole night up scanning my laptop with the scanners recommended before posting in this forum. Well, I hope I post it right the first time.

    I just reformatted my computer because I could not take out ZeroAccess Trojan, I didn't know how to delete it manually, and McAfee(my previous antivirus) just keeps on saying it fixed it, even though it didn't because it kept popping. So I just reformatted EVERYTHING. But before that, I backed up my files into my external hard drive, forgetting that the virus might have been saved to my external hard drive as well.

    Well, after reformatting, I installed BitDefender (goodbye mCafee), on its first scan, a kind of trojan appeared instead of ZeroAccess Trojan, but i forgot what it was, upon connecting my external hard drive to retrieve my files. Too lazy to fix it, I just did a full scan on my external HD, made bitdefender do its thing, making sure that my backed up files are clean.

    And I did another reformat. Installed and updated bitdefender, and connected to my external hard drive to retrieve my stuff, and then Trojan.Heur.aqX@a8dzk7h. And i thought my external HD was clean. :(

    I will post logs after this post. Thanks so much for your help! I am willing to learn! I am an IT student, starting fresh, and this annoys me so much that I can't fix my own computer.
     
  2. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Bitdefender log when it first spotted the trojan


    Product: Bitdefender Antivirus Plus 2013
    Log path: C:\Program Files\Common Files\Bitdefender\SetupInformation\{34480DEE-54D6-4985-A817-CA30E9BBC94C}\qs_scan_log.html

    Scan paths:
    Filename Virus Name Action taken
    C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe Trojan.Heur.FU.aqX@a8dzK7h Disinfected
     

  3. to hide this advert.

  4. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Here is a scan by Bitdefender to my external hard drives.

    [​IMG]

    if the image doesn't work, this is the link:
    http://www.sendspace.com/file/aeiwft

    This is the full scan made by bitdefender after external hard drive scan
    [​IMG]

    if the image doesn't work, this is the link:
    http://www.sendspace.com/file/zevxxo

    For some reason I can't find the log texts for these two scans, I was searching all over, so I just took snapshots of it.
     
    Last edited: 2012/07/26
  5. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Malware Bytes Log

    Malwarebytes Anti-Malware (Trial) 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.07.26.10

    Windows 7 x64 NTFS
    Internet Explorer 8.0.7600.16385
    Juneelyn :: JUNEELYN-HP [administrator]

    Protection: Enabled

    7/26/2012 5:33:26 AM
    mbam-log-2012-07-26 (05-33-26).txt

    Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 363216
    Time elapsed: 24 minute(s), 37 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)
     
  6. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Quick scan by aswMBR

    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-07-26 05:58:41
    -----------------------------
    05:58:41.540 OS Version: Windows x64 6.1.7600
    05:58:41.540 Number of processors: 4 586 0x2505
    05:58:41.540 ComputerName: JUNEELYN-HP UserName: Juneelyn
    05:58:42.694 Initialize success
    05:58:48.689 AVAST engine defs: 12072600
    05:59:19.421 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    05:59:19.421 Disk 0 Vendor: Hitachi_ PC4O Size: 476940MB BusType: 3
    05:59:19.467 Disk 0 MBR read successfully
    05:59:19.467 Disk 0 MBR scan
    05:59:19.483 Disk 0 unknown MBR code
    05:59:19.483 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
    05:59:19.499 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 442409 MB offset 409600
    05:59:19.514 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 34227 MB offset 906463232
    05:59:19.545 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 976560128
    05:59:19.577 Disk 0 scanning C:\Windows\system32\drivers
    05:59:26.191 Service scanning
    05:59:28.391 Service bdfwfpf C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys **LOCKED** 5
    05:59:48.218 Modules scanning
    05:59:48.218 Disk 0 trace - called modules:
    05:59:48.234 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
    05:59:48.250 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800a161060]
    05:59:48.250 3 CLASSPNP.SYS[fffff8800100143f] -> nt!IofCallDriver -> [0xfffffa8009faeb10]
    05:59:48.265 5 hpdskflt.sys[fffff8800160c289] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80080f0050]
    05:59:49.778 AVAST engine scan C:\Windows
    05:59:52.399 AVAST engine scan C:\Windows\system32
    06:02:05.265 AVAST engine scan C:\Windows\system32\drivers
    06:02:28.259 AVAST engine scan C:\Users\Juneelyn
    06:03:25.559 AVAST engine scan C:\ProgramData
    06:04:42.517 Scan finished successfully
    06:06:34.088 Disk 0 MBR has been saved successfully to "C:\Users\Juneelyn\Desktop\MBR.dat "
    06:06:34.088 The log file has been saved successfully to "C:\Users\Juneelyn\Desktop\aswMBR Quick Scan.txt "
     
  7. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    GMER scan log: I am not sure if this correct, this was all that displayed:

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2012-07-26 06:28:24
    Windows 6.1.7600
    Running: ietl1h59.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af06b4c1
    Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af06b4c1 (not active ControlSet)

    ---- EOF - GMER 1.0.15 ----
     
  8. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    DDS log

    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 8.0.7600.16385
    Run by Juneelyn at 6:12:13 on 2012-07-26
    Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.7990.3910 [GMT -7:00]
    .
    AV: Bitdefender Antivirus *Enabled/Updated* {98CD50CE-5097-4098-9669-6C401FB3969C}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Bitdefender Antispyware *Enabled/Updated* {23ACB12A-76AD-4F16-ACD9-57326434DC21}
    FW: Bitdefender Firewall *Disabled* {A0F6D1EB-1AF8-41C0-BD36-C575E160D1E7}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Program Files\IDT\WDM\STacSV64.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\Hpservice.exe
    C:\Windows\system32\vcsFPService.exe
    C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
    C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisService.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\IDT\WDM\AESTSr64.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
    C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe
    C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
    C:\Program Files\IDT\WDM\sttray64.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
    C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe
    C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
    C:\Windows\SysWOW64\RunDll32.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\taskeng.exe
    C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\system32\DllHost.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
    C:\Program Files\Bitdefender\Bitdefender 2013\seccenter.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files\Bitdefender\Bitdefender 2013\odscanui.exe
    C:\Users\Juneelyn\Desktop\aswMBR.exe
    C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
    C:\Windows\System32\svchost.exe -k swprv
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = about:blank
    mStart Page = about:blank
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: EgisPBIE Class: {7b51ccbe-4af9-44a6-bdab-d7f7e4c4e6f9} - C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisPBIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
    mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe "
    mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
    mRun: [VitaKeyTSR] C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe /run
    mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
    mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
    TCP: Interfaces\{CF152C54-531A-4C3C-852D-CC17C75EEEB9} : DhcpNameServer = 75.75.75.75 75.75.76.76
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    LSA: Notification Packages = EgisPwdFilter EgisDSPwdFilter
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO-X64: Search Helper - No File
    BHO-X64: EgisPBIE Class: {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisPBIE.dll
    BHO-X64: EgisPBIE - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
    mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
    mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe "
    mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
    mRun-x64: [VitaKeyTSR] C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe /run
    mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
    mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 avc3;avc3;C:\Windows\system32\DRIVERS\avc3.sys --> C:\Windows\system32\DRIVERS\avc3.sys [?]
    R0 gzflt;gzflt;C:\Windows\system32\DRIVERS\gzflt.sys --> C:\Windows\system32\DRIVERS\gzflt.sys [?]
    R1 bdfwfpf;bdfwfpf;C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2012-7-26 103504]
    R1 DVMIO;DeviceVM IO Service;C:\Windows\system32\DRIVERS\dvmio.sys --> C:\Windows\system32\DRIVERS\dvmio.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-7-25 89600]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 DvmMDES;DeviceVM Meta Data Export Service;C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-9-28 338208]
    R2 EgisTec Service;EgisTec Service;C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisService.exe [2010-6-14 697712]
    R2 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-6-14 646000]
    R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992]
    R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-8-5 681528]
    R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896]
    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-9-17 92216]
    R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?]
    R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-8-23 26680]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-7-25 13336]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-7-26 655944]
    R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
    R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344]
    R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-7-25 2533400]
    R2 UPDATESRV;Bitdefender Desktop Update Service;C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [2012-7-26 68416]
    R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 avchv;avchv Function Driver;C:\Windows\system32\DRIVERS\avchv.sys --> C:\Windows\system32\DRIVERS\avchv.sys [?]
    R3 avckf;avckf;C:\Windows\system32\DRIVERS\avckf.sys --> C:\Windows\system32\DRIVERS\avckf.sys [?]
    R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys --> C:\Windows\system32\drivers\btwampfl.sys [?]
    R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]
    R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
    R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys --> C:\Windows\system32\DRIVERS\Impcd.sys [?]
    R3 intelkmd;intelkmd;C:\Windows\system32\DRIVERS\igdpmd64.sys --> C:\Windows\system32\DRIVERS\igdpmd64.sys [?]
    R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
    R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys --> C:\Windows\system32\DRIVERS\NETw5s64.sys [?]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
    R3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys --> C:\Windows\system32\DRIVERS\WDKMD.sys [?]
    S3 BDSandBox;BDSandBox;\??\C:\Windows\system32\drivers\bdsandbox.sys --> C:\Windows\system32\drivers\bdsandbox.sys [?]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-3-5 340240]
    S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
    S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
    S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
    .
    =============== Created Last 30 ================
    .
    2012-07-26 10:43:36 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F742F78F-E072-4CA3-802D-D69C97328A74}\offreg.dll
    2012-07-26 10:12:05 9133488 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F742F78F-E072-4CA3-802D-D69C97328A74}\mpengine.dll
    2012-07-26 10:12:05 279656 ------w- C:\Windows\System32\MpSigStub.exe
    2012-07-26 09:22:04 76944 ----a-w- C:\Windows\System32\drivers\bdvedisk.sys
    2012-07-26 09:00:23 356003 ----a-w- C:\ProgramData\1343292415.bdinstall.bin
    2012-07-26 08:58:49 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\Malwarebytes
    2012-07-26 08:58:41 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-07-26 08:58:41 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-07-26 08:58:40 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-07-26 08:51:09 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
    2012-07-26 08:51:08 826368 ----a-w- C:\Windows\SysWow64\rdpcore.dll
    2012-07-26 08:51:08 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
    2012-07-26 08:51:08 204800 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
    2012-07-26 08:50:39 -------- d-----w- C:\ProgramData\BDLogging
    2012-07-26 08:50:37 79952 ----a-w- C:\Windows\System32\drivers\bdsandbox.sys
    2012-07-26 08:50:37 511328 ----a-w- C:\Windows\capicom.dll
    2012-07-26 08:50:25 691896 ----a-w- C:\Windows\System32\drivers\avc3.sys
    2012-07-26 08:50:25 545064 ----a-w- C:\Windows\System32\drivers\avckf.sys
    2012-07-26 08:50:25 258736 ----a-w- C:\Windows\System32\drivers\avchv.sys
    2012-07-26 08:49:54 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\Bitdefender
    2012-07-26 08:49:52 -------- d-----w- C:\ProgramData\Bitdefender
    2012-07-26 08:42:14 -------- d-----w- C:\Program Files\Common Files\Bitdefender
    2012-07-25 22:33:15 -------- d-----w- C:\Users\Juneelyn\AppData\Local\ATI
    2012-07-25 22:33:14 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\PictureMover
    2012-07-25 22:32:29 -------- d-----w- C:\Users\Juneelyn\AppData\Local\EgisTec
    2012-07-25 22:32:20 -------- d-----w- C:\Users\Juneelyn\AppData\Local\Broadcom
    2012-07-25 22:32:16 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\Stardock
    2012-07-25 22:32:16 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\hpqLog
    2012-07-25 22:32:15 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\Intel Corporation
    2012-07-25 22:32:15 -------- d-----w- C:\Users\Juneelyn\AppData\Roaming\Intel
    2012-07-25 22:32:15 -------- d-----w- C:\Users\Juneelyn\AppData\Local\EgisTec IPS
    2012-07-25 22:32:02 -------- d-----r- C:\Users\Juneelyn\Virtual Machines
    2012-07-25 22:31:34 -------- d-----w- C:\Users\Juneelyn\AppData\Local\RemEngine
    2012-07-25 19:13:19 -------- d-----w- C:\Users\Juneelyn\AppData\Local\Hewlett-Packard
    2012-07-25 19:13:09 -------- d-----w- C:\Users\Juneelyn\AppData\Local\Hewlett-Packard_Company
    2012-07-25 19:12:26 -------- d-----w- C:\Users\Juneelyn\AppData\Local\VirtualStore
    2012-07-25 13:10:38 148992 ----a-w- C:\Windows\System32\t2embed.dll
    2012-07-25 13:10:38 109056 ----a-w- C:\Windows\SysWow64\t2embed.dll
    2012-07-25 13:10:30 861184 ----a-w- C:\Windows\System32\oleaut32.dll
    2012-07-25 13:10:30 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2012-07-25 13:10:21 3123712 ----a-w- C:\Windows\System32\win32k.sys
    2012-07-25 13:10:08 1525248 ----a-w- C:\Program Files\Windows Media Player\wmpnetwk.exe
    2012-07-25 13:08:51 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
    2012-07-25 13:07:41 558592 ----a-w- C:\Windows\System32\spoolsv.exe
    2012-07-25 13:07:32 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
    2012-07-25 13:07:32 463360 ----a-w- C:\Windows\System32\drivers\srv.sys
    2012-07-25 13:07:32 402944 ----a-w- C:\Windows\System32\drivers\srv2.sys
    2012-07-25 13:07:32 236032 ----a-w- C:\Windows\System32\srvsvc.dll
    2012-07-25 13:07:32 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
    2012-07-25 13:07:23 633856 ----a-w- C:\Windows\System32\comctl32.dll
    2012-07-25 13:07:23 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll
    2012-07-25 13:07:13 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll
    2012-07-25 13:07:13 1024512 ----a-w- C:\Windows\System32\wmpmde.dll
    2012-07-25 13:06:55 340992 ----a-w- C:\Windows\System32\schannel.dll
    2012-07-25 13:06:55 224256 ----a-w- C:\Windows\SysWow64\schannel.dll
    2012-07-25 13:06:44 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2012-07-25 13:06:44 2048 ----a-w- C:\Windows\System32\tzres.dll
    2012-07-25 13:04:54 -------- d-----w- C:\Windows\ehome
    2012-07-25 12:46:40 -------- d-----w- C:\Program Files (x86)\Microsoft
    2012-07-25 12:46:38 -------- d-----w- C:\Program Files (x86)\MSN Toolbar
    2012-07-25 12:46:36 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer
    2012-07-25 12:43:11 -------- d-----w- C:\Program Files (x86)\HP Games
    2012-07-25 12:43:08 -------- d-----w- C:\ProgramData\WildTangent
    2012-07-25 12:42:14 -------- d-----w- C:\Program Files (x86)\Downloaded Installations
    2012-07-25 12:40:57 -------- d-----w- C:\ProgramData\EgisTec
    2012-07-25 12:40:53 -------- d-----w- C:\Program Files (x86)\Common Files\EgisTec
    2012-07-25 12:40:50 -------- d-----w- C:\ProgramData\EgisTec IPS
    2012-07-25 12:40:50 -------- d-----w- C:\Program Files (x86)\EgisTec IPS
    2012-07-25 12:40:40 -------- d-----w- C:\Program Files\EgisTec IPS
    2012-07-25 12:40:14 -------- d-----w- C:\ProgramData\Norton
    2012-07-25 12:40:02 -------- d-----w- C:\ProgramData\NortonInstaller
    2012-07-25 12:39:36 -------- d-----w- C:\Program Files (x86)\Intel Corporation
    2012-07-25 12:39:36 -------- d-----w- C:\Program Files (x86)\Common Files\Intel Corporation
    2012-07-25 12:39:22 -------- d-----w- C:\ProgramData\Symantec
    2012-07-25 12:39:22 -------- d-----w- C:\Program Files (x86)\Symantec
    2012-07-25 12:39:14 -------- d-----w- C:\ProgramData\Uninstall
    2012-07-25 12:38:54 -------- d-----w- C:\Program Files (x86)\Microsoft WSE
    2012-07-25 12:38:50 -------- d-----w- C:\ProgramData\RoxioNow
    2012-07-25 12:38:48 -------- d-----w- C:\Program Files (x86)\Roxio
    2012-07-25 12:38:36 -------- d-----w- C:\ProgramData\PictureMover
    2012-07-25 12:38:36 -------- d-----w- C:\Program Files (x86)\PictureMover
    2012-07-25 12:36:12 -------- d-----w- C:\Program Files (x86)\Times Reader
    2012-07-25 12:36:00 -------- dc-h--w- C:\ProgramData\{05971B75-B620-4D64-9985-7971BEF763A2}
    2012-07-25 12:35:58 -------- d-----w- C:\Program Files\Stardock
    2012-07-25 12:26:16 0 ----a-w- C:\Windows\ativpsrm.bin
    2012-07-25 12:24:38 4096 ----a-w- C:\Windows\System32\drivers\pl-PL\vpchbus.sys.mui
    2012-07-25 12:23:10 -------- d-----w- C:\Program Files\Common Files\Intel
    2012-07-25 12:23:10 -------- d-----w- C:\Program Files (x86)\Cisco
    2012-07-25 12:23:02 -------- d-----w- C:\Windows\HPQ
    2012-07-25 12:21:53 -------- d-----w- C:\Program Files\Validity Sensors
    2012-07-25 12:21:13 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
    2012-07-25 12:21:13 349800 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
    2012-07-25 12:21:13 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
    2012-07-25 12:21:10 -------- d-----w- C:\Program Files (x86)\Realtek
    2012-07-25 12:18:50 39464 ----a-w- C:\Windows\System32\drivers\btwl2cap.sys
    2012-07-25 12:18:50 344616 ----a-w- C:\Windows\System32\drivers\btwampfl.sys
    2012-07-25 12:18:50 21544 ----a-w- C:\Windows\System32\drivers\btwrchid.sys
    2012-07-25 12:18:50 135720 ----a-w- C:\Windows\System32\drivers\btwavdt.sys
    2012-07-25 12:18:50 102952 ----a-w- C:\Windows\System32\drivers\btwaudio.sys
    2012-07-25 12:17:59 -------- d-----w- C:\Program Files\WIDCOMM
    2012-07-25 12:15:39 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll
    .
    ==================== Find3M ====================
    .
    2012-07-25 13:08:51 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
    2012-07-25 13:07:05 347648 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
    2012-07-25 13:07:05 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
    2012-06-02 22:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll
    2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll
    2012-06-02 22:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe
    2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll
    .
    ============= FINISH: 6:12:50.97 ===============
     
  9. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Second log from DDS:

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 7/25/2012 12:11:38 PM
    System Uptime: 7/26/2012 2:32:02 AM (4 hours ago)
    .
    Motherboard: Hewlett-Packard | | 162F
    Processor: Intel(R) Core(TM) i7 CPU M 640 @ 2.80GHz | CPU | 2800/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 432 GiB total, 384.245 GiB free.
    D: is FIXED (NTFS) - 33 GiB total, 4.888 GiB free.
    E: is CDROM ()
    F: is FIXED (NTFS) - 293 GiB total, 292.871 GiB free.
    G: is FIXED (NTFS) - 293 GiB total, 292.387 GiB free.
    H: is FIXED (NTFS) - 346 GiB total, 203.292 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP1: 7/25/2012 12:12:45 PM - First_User_Boot
    RP2: 7/26/2012 1:46:43 AM - Windows Update
    RP3: 7/26/2012 1:51:12 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    ActiveCheck component for HP Active Support Library
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.3.3 MUI
    Adobe Shockwave Player 11.5
    Agatha Christie - Peril at End House
    Alcor Micro USB Card Reader
    Bejeweled 2 Deluxe
    Bing Bar
    Bing Bar Platform
    Bing Rewards Client Installer
    Blackhawk Striker 2
    Blasterball 3
    Blio
    Bounce Symphony
    Build-a-lot 2
    Cake Mania
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Chuzzle Deluxe
    CyberLink DVD Suite
    D3DX10
    Diner Dash 2 Restaurant Rescue
    Dora's World Adventure
    DVD Menu Pack for HP MediaSmart Video
    Energy Star Digital Logo
    Escape Rosecliff Island
    ESU for Microsoft Windows 7
    Farm Frenzy
    FATE
    Fences Pro
    Final Drive Nitro
    Heroes of Hellas 2 - Olympia
    HP CloudDrive
    HP Customer Experience Enhancements
    HP Documentation
    HP Game Console
    HP Games
    HP MediaSmart DVD
    HP MediaSmart Music
    HP MediaSmart Photo
    HP MediaSmart Video
    HP MediaSmart Webcam
    HP MediaSmart/TouchSmart Netflix
    HP MovieStore
    HP Photo Creations
    HP Power Manager
    HP Quick Launch
    HP QuickWeb Installer
    HP Setup
    HP Setup Manager
    HP SimplePass Identity Protection
    HP Software Framework
    HPAsset component for HP Active Support Library
    Hulu Desktop
    IDT Audio
    Intel(R) Control Center
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology
    Intel(R) Turbo Boost Technology Driver
    Java Auto Updater
    Java(TM) 6 Update 21
    Jewel Quest Solitaire 2
    Junk Mail filter update
    LabelPrint
    Malwarebytes Anti-Malware version 1.62.0.1300
    Microsoft Default Manager
    Microsoft Office 2010
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft WSE 3.0 Runtime
    Movie Theme Pack for HP MediaSmart Video
    MSVCRT
    MSVCRT_amd64
    Norton Online Backup
    Penguins!
    PhotoNow!
    PictureMover
    Plants vs. Zombies
    PlayReady PC Runtime x86
    Poker Superstars III
    Polar Bowler
    Polar Golfer
    Power2Go
    PowerDirector
    PX Profile Update
    Realtek Ethernet Controller Driver
    Recovery Manager
    RoxioNow Player
    Times Reader
    Virtual Families
    Virtual Villagers 4 - The Tree of Life
    Wheel of Fortune 2
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Zuma Deluxe
    .
    ==== Event Viewer Messages From Past Week ========
    .
    7/26/2012 1:40:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the HP Software Framework Service service to connect.
    7/26/2012 1:40:35 AM, Error: Service Control Manager [7000] - The HP Software Framework Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    7/26/2012 1:40:35 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service hpqwmiex with arguments " " in order to run the server: {F5539356-2F02-40D4-999E-FA61F45FE12E}
    7/26/2012 1:40:02 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.
    7/25/2012 3:32:30 PM, Error: Microsoft-Windows-DistributedCOM [10009] - DCOM was unable to communicate with the computer WIN-076TKO4S45G using any of the configured protocols.
    .
    ==== End Of File ===========================
     
  10. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Some of my posts are like pending for approval. I hope it gets approved. I await for answer. :) No Pressure! I won't log into any accounts as of now until my laptop is clean. :) well, except this forum, I have to log in. :)
     
  11. 2012/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard [​IMG]

    I'd say you have a false positive.

    Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders, UN-check Hide protected operating system files.
    NOTE. Make sure to reverse the above changes, when done with this step.
    Upload following files to http://www.virustotal.com/ for security check:
    - C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
    IMPORTANT! If the file is listed as already analyzed, click on Reanalyse file now button.
    Post scan results.
     
  12. 2012/07/26
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Hi! I couldn't find the file anymore. :( I couldn't fine BluetoothHeadsetProxy.exe in its folder even after I clicked on "Show hidden files, and folders," and unchecked hide protected operating systems. Also, I applied these settings to all folders.

    Does that mean it got deleted by bitdefender? Should I replace the file? Thanks so much! :)
     
  13. 2012/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I'm not familiar with that particular bluetooth utility but if you don't use it you should be fine.
    I doubt it was anything malicious.
     
  14. 2012/07/27
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    thanks so much broni! yeah i don't use bluetooth headset anyway. i was just concerned why it was analyzed as trojan.heur.aqx when I just reformatted my computer. i would understand if it was from my external hard drive but this one was from C: drive. so, you may be right it's a false positive. i'll contine scanning every week. :) thanks!
     
  15. 2012/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    "heur" means heuristic.
    The assessment in this case is based just on known malicious code so it's never 100% accurate.

    Good luck!
     
  16. 2012/07/27
    jpab29

    jpab29 Inactive Thread Starter

    Joined:
    2012/07/25
    Messages:
    12
    Likes Received:
    0
    Thanks! :) I will remove the URL links that leads to my image files in sendspace since it is now resolved. :) Looking forward to learn a lot here WindowsBBS! :)
     
  17. 2012/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    :)...
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.